The CRI-O credential provider project follows the same security policy as the main CRI-O project.
To report a security vulnerability, please use the GitHub Security Advisory feature to privately report the issue.
You can also report vulnerabilities by following the Kubernetes Security and Disclosure Information process.
The maintainers will acknowledge vulnerability reports within 7 days and aim to provide a fix or mitigation plan within 30 days.
Security fixes are applied to the most recent tagged release (the highest semver tag in the repository).
| Version | Supported |
|---|---|
| Most recent tagged release | ✅ |
| Older releases | ❌ |
Security announcements are made through GitHub Security Advisories.